ECHO-0414-10DF-B858

Bulletin has no description...

ECHO-DA51-97F9-E11C

Bulletin has no description...

ECHO-0413-5BD8-5E30

Bulletin has no description...

ECHO-DC86-0C7B-0A2C

Bulletin has no description...

ECHO-122E-E9CA-89D9

Bulletin has no description...

CVE-2026-8093

CVE-2026-8093 concerns memory-safety bugs in Firefox 150.0.1. The gathered records describe memory corruption clues and state that, with sufficient effort, some flaws could have allowed arbitrary code execution. Mozilla's advisory confirms the issue was fixed in Firefox 150.0.2. Affected software...

RUSTSEC-2026-0144 `Program<System>` accepts arbitrary executable programs

Affected versions of anchor-lang did not properly validate accounts declared as Program. The generic Program validation path used Pubkey::default as a sentinel to decide whether any executable program should be accepted. Since the system program id is also the default pubkey, Program was treated...

ECHO-DC11-DAA6-FC93

Bulletin has no description...

CVE-2026-25436 WordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal Elementor Addons: from n/a before 1.7.1053...

GHSA-FRH3-6PV6-RC8J

creationtimestamp| type| source ---|---|--- 2026-05-07 06:10:29+00:00| seen| https://gist.github.com/alon710/560a262a37ded8b644e3892d54c879bb...

BELL-CVE-2026-43109

Bulletin has no description...

BELL-CVE-2026-43198

Bulletin has no description...

CVE-2026-41203

creationtimestamp| type| source ---|---|--- 2026-05-07 05:45:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlaj6f7qlo2k 2026-05-07 07:30:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlap2odhxt2o 2026-05-07 07:30:41+00:00| seen|...

K000161154: Sequelize vulnerability CVE-2026-30951

Security Advisory Description Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The traverseJSON function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST... AS SQL. An...

CVE-2026-41891

creationtimestamp| type| source ---|---|--- 2026-05-07 05:15:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlahjfoxve2e...

CVE-2026-41143

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data'idfiche' value sourced from $POST'idfiche' is concatenated directly into a raw SQL query without any...

CVE-2026-41143

YesWiki contains an authenticated SQL injection in the bazar module, via id_fiche in EntryManager::formatDataBeforeSave() (code path: tools/bazar/services/EntryManager.php:704). The vulnerable query concatenates $_POST['id_fiche'] into SQL without sanitization, e.g. selecting MIN(time) from pages...

EUVD-2026-28312

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data'idfiche' value sourced from $POST'idfiche' is concatenated directly into a raw SQL query without any...

CVE-2026-41670 Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value directly from incoming SAML AuthnRequest messages as the destination for the SAML response, without validating it against the...

SUSE CVE-2026-43047

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Check to ensure report responses match the request It is possible for a malicious or clumsy device to respond to a specific report's feature request using a completely different report ID. This can cause confusio...